Stopping attacks at the DNS lookup, before any connection is made

Contents

1. 1Executive summary
2. 2The challenge
3. 3Architecture
4. 4How it works
5. 5Capabilities in detail
6. 6Security and data handling
7. 7Where it fits
8. 8Deployment and system requirements
9. 9Technical specifications
10. 10Getting started

1Executive summary

DNSGuard is a protective resolver, in the TotalHeal cloud or on your own Linux hosts. It blocks malware, phishing and look-alike domains, detects DNS tunnelling, re-checks every answer and lands its detections next to your endpoint alerts — without an agent on every device.

2The challenge

Most malware, phishing and data-theft traffic starts with a DNS lookup. A protective resolver stops the lookup before a connection is made, for every device on a site or on the road, without an agent on every device.

The TotalHeal approach. Threat-blocking protective DNS from the TotalHeal cloud or your own resolver, with blocks and detections landing next to your endpoint alerts. No content-category filtering.

3Architecture

4How it works

1. PointSend devices to the cloud resolver by DoH, or run the resolver on your own Linux host.
2. CheckEach lookup is checked against threat lists, your indicators, look-alikes and new domains.
3. Re-checkEvery CNAME target and returned address is checked too.
4. Block or detectSinkhole or NXDOMAIN with a standard Blocked code, or detect only, per policy.

5Capabilities in detail

• Malware and phishing domainsKnown malicious hosts blocked; shared platforms such as GitHub or Drive are never listed, because DNS cannot see a path.
• Your own threat intelYour domains, URL hosts and IP addresses as blocking triggers — up to 50,000 indicators.
• Look-alike detectionTypo-squats, swapped letters, homoglyphs (including Cyrillic) and brand-plus-lure names, with Indian banks, payment apps and government portals built in.
• New and never-seen domainsNewly registered domains (with a feed) and domains your organisation has never looked up before.
• DNS tunnelling and exfiltrationDetected from entropy, label length, record types and volume; detect or block per policy.
• Answers are checked tooEvery CNAME target and returned address is re-checked.
• Policies per networkAllow and block lists, safe search for Google, Bing, DuckDuckGo and YouTube, sinkhole or NXDOMAIN, with a standard “Blocked” error code.
• Standard formatsEvery list is a standard RPZ zone you can export for BIND, Unbound or PowerDNS. DoH in the cloud; DNS, DoT and DoH on your own resolver.
• Never an open resolver, never fails openUnknown clients refused, rate limits, zone transfers refused; signed policy bundles with last-known-good. Privacy modes per network; BYOD networks never log allowed queries.

6Security and data handling

• Never an open resolverUnknown clients are refused, rate limits apply and zone transfers are refused.
• Never fails openSigned policy bundles with last known good.
• Privacy by networkBYOD networks never log allowed queries.

7Where it fits

8Deployment and system requirements

9Technical specifications

10Getting started

• Cloud: a client that speaks DoH
• On-premises: a Linux host with systemd, outbound HTTPS, a TLS certificate for DoT/DoH, a Professional or Elite licence

Start a 30 days trial in the TotalHeal console with a Sttiz account. For a quote, an on-premises installation or the procurement dossier (compliance matrix, bill of materials, architecture and hardening, SLA, OEM authorisation letter), write to business@totalhealsecurity.com.